pre-commit: Bump versions

... and use native hooks for bandit and hacking

Change-Id: Iaafe890b48eb7607064b70f51253d38b3bd933aa

Author: kajinamit

.pre-commit-config.yaml

@@ -1,15 +1,6 @@
-# We from the Oslo project decided to pin repos based on the
-# commit hash instead of the version tag to prevend arbitrary
-# code from running in developer's machines.  To update to a
-# newer version, run `pre-commit autoupdate` and then replace
-# the newer versions with their commit hash.
-
-default_language_version:
-  python: python3
-
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: 9136088a246768144165fcc3ecc3d31bb686920a # v3.3.0
+    rev: v5.0.0
     hooks:
       - id: trailing-whitespace
       # Replaces or checks mixed line ending
@@ -27,13 +18,13 @@ repos:
       - id: debug-statements
       - id: check-yaml
         files: .*\.(yaml|yml)$
-  - repo: local
+  - repo: https://opendev.org/openstack/hacking
+    rev: 7.0.0
     hooks:
-      - id: flake8
-        name: flake8
-        additional_dependencies:
-          - hacking>=6.1.0,<6.2.0
-        language: python
-        entry: flake8
-        files: '^.*\.py$'
-        exclude: '^(doc|releasenotes|tools)/.*$'
+      - id: hacking
+        additional_dependencies: []
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.7.10
+    hooks:
+      - id: bandit
+        args: ['-x', 'tests,benchmark', '--skip', 'B404']

test-requirements.txt

@@ -1,5 +1,3 @@
-hacking>=6.1.0,<6.2.0 # Apache-2.0
-
 fixtures>=3.0.0 # Apache-2.0/BSD
 testtools>=2.2.0 # MIT
 stestr>=2.0.0 # Apache-2.0
@@ -9,8 +7,3 @@ oslotest>=3.2.0 # Apache-2.0
 
 # rootwrap daemon's client should be verified to run in eventlet
 eventlet>=0.18.2 # MIT
-
-# Bandit security code scanner
-bandit>=1.7.0,<1.8.0 # Apache-2.0
-
-pre-commit>=2.6.0 # MIT

tox.ini

@@ -16,12 +16,9 @@ commands =
 
 [testenv:pep8]
 deps =
-  -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
-  -r{toxinidir}/test-requirements.txt
+  pre-commit>=2.6.0 # MIT
 commands =
   pre-commit run -a
-  # Run security linter
-  bandit -r oslo_rootwrap tests -n5 --skip B404
 
 [testenv:cover]
 deps = {[testenv]deps}